CVE-2026-24089: Improper Validation of Syntactic Correctness of Input in Kernel
Memory corruption while processing fastboot commands with invalid input.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Implement or enable validation of the syntactic correctness of fastboot command input in the kernel so malformed commands are rejected before processing to prevent memory corruption.
kernel (fastboot command processor) syntactic validation of fastboot input = enabled - Compensating control
Restrict or disable access to the fastboot interface where feasible; ensure only trusted sources can send fastboot commands (e.g., limit physical/management access and block untrusted interfaces) to reduce exposure to invalid inputs.
- Operational
Monitor for crashes or signs of memory corruption related to fastboot processing, avoid processing untrusted fastboot commands, and apply vendor/kernel updates addressing this issue as soon as they become available.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-24089?
The severity of CVE-2026-24089 is rated high with a score of 7.2.
How do I fix CVE-2026-24089?
To fix CVE-2026-24089, apply the patch that has been made available by Qualcomm.
What type of vulnerability is CVE-2026-24089?
CVE-2026-24089 is an improper validation of syntactic correctness of input vulnerability leading to memory corruption.
Which Qualcomm firmware versions are affected by CVE-2026-24089?
CVE-2026-24089 affects multiple Qualcomm firmware versions including Ar8031, Ar8035, Cologne, Cq7790, Cq8725s, Qmp1000, Qmp2001, and Qpa1083bd.
What are the potential impacts of CVE-2026-24089?
The potential impacts of CVE-2026-24089 include memory corruption that could lead to denial of service or arbitrary code execution.